chore(deps): bump path-to-regexp from 6.2.2 to 7.0.0

[dependabot]

Bumps path-to-regexp from 6.2.2 to 7.0.0.

Release notes

Sourced from path-to-regexp's releases.

Wildcard, unicode, and modifier changes

Hi all! There's a few major breaking changes in this release so read carefully.

Breaking changes:

• Parameter names can now contain all unicode identifier characters (defined as regex \p{XID_Continue}).
• No more implied prefix with / and . (this is relevant when using ?, *, or +)
• Modifiers (?, *, +) must be used after a param explicitly wrapped in {}
• The API is no longer supporting arrays or regexes as input
• The wildcard (standalone *) has been added back and matches Express.js expected behavior
• Removed endsWith option
• Renamed strict: true to trailing: false
• Reserved ;, ,, !, and @ for future use-cases
• Removed tokensToRegexp, tokensToFunction and regexpToFunction in favor of simplifying exports
• Enable a "loose" mode by default, so / can be repeated multiple times in a matched path (i.e. /foo works like //foo, etc)
• encode and decode no longer receive the token as the second parameter
• Removed the ESM + CommonJS dual package in favor of only one CommonJS supported export
• Minimum JS support for ES2020 (previous ES2015)
• Stricter compile function - expects an array of strings in repeated parameters, and strings in non-repeated parameters

Added:

• Adds encodePath to fix an issue around encode being used for both path and parameters (the path and parameter should be encoded slightly differently)
• Adds loose as an option to support arbitrarily matching the delimiter in paths, e.g. foo/bar and foo///bar should work the same
• Allow encode and decode to be set to false which skips all processing of the parameters input/output
• All remaining methods support TokenData (exported, returned by parse) as input
  • This should be useful if you are programmatically building paths to match or want to avoid parsing multiple times

Requests for feedback:

• Requiring {} is an obvious drawback but I'm seeking feedback on whether it helps make path behavior clearer
  • Related: Removing / and . as implicit prefixes
• Removing array and regex support is to reduce the overall package size for things many users don't need
• Unicode IDs are added to align more closely with browser URLPattern behavior, which uses JS identifiers

pillarjs/path-to-regexp@v6.2.2...v7.0.0

Commits

• ec35fbd 7.0.0
• c1541bc NPM audit fix
• c0736d4 Remove loose string reference
• 17ce0be Make key prefix/suffix/modifier/separator optional
• 8b74404 Explicit prefix and suffix modifiers (#306)
• dfa4451 Unicode path name character tests
• e796ace Default encode/decode, allow disabling
• 578b072 Test loose can be disabled
• 01086a0 Add wildcard functionality
• db3beff Remove support for regexp and arrays
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher

🚮 Removed packages: npm/@actions/core@1.10.1, npm/@actions/github@6.0.0

View full report↗︎

[chris48s]

Need to have a good old read over this changelog and work out what we need to do to update this one.

[chris48s]

OK, so one of the big problems we have is https://github.com/pillarjs/path-to-regexp#errors

Basically everywhere we have a /:version+ or /:branch* we need to change it.
That is annoying because we have to change a crap-ton of things, but fundamentally we change the crap-ton of things and then we get on with our lives.

Possibly more of an issue is

The API is no longer supporting arrays or regexes as input

I need to test whether this actually means we completely can't use regex any more, or whether this is saying you can't pass /slash notation/ and RegExp() objects but can still use regex in strings. I'm a bit unclear..

If that is completely removed then that is going to be more difficult to deal with. We don't have lots of regex routes, but the ones we have are there because we don't have another option. I think now that we have got rid of wercker the only ones we have are actually

https://github.com/badges/shields/blob/master/services/travis/travis-build.service.js#L16

https://github.com/badges/shields/blob/master/services/static-badge/static-badge.service.js#L48

..but obviously one of those is pretty much the most commonly used route on the service. Need to have a think about how to deal with that issue..

Possibly refs #9852